Privacy notice

Tunturipuun Kauppa Oy, www.tunturipuu.fi is committed to protecting the privacy of the users of its services and complies in its operations with data protection legislation and good data protection practices.

  1. Data controller

Name: Tunturipuun Kauppa Oy
Business ID: 3548399-7
Address: Puistokatu 9 as 3, 39500 Ikaalinen
Phone: 020 731 1101
Email: tunturipuu@tunturipuu.fi

Contact details for matters concerning the register

Name: Esa Seppänen
Address: Puistokatu 9 as 3, 39500 Ikaalinen
Phone: 020 731 1101
Email: tunturipuu@tunturipuu.fi

  1. Data subjects

The register contains customers, potential customers and partners.

  1. Purpose of processing personal data
Data subjectsPurpose of processingLegal basis for processing
Customers (contacts) and partnersEnabling contacts required for customer service and maintaining the customer relationship.Controller’s legitimate interest
Potential customers and website usersContact requests and newsletter subscriptions received through the website.Controller’s legitimate interest
  1. Personal data to be stored in the register

The customer register contains the following information:

InformationCustomer and partnersPotential customer / website userPurpose
NamexxIdentification / contacting
Phone numberxxContacting
Email addressxxContacting
Employer / companyxxManaging the customer relationship / targeting marketing
Role / titlexxManaging the customer relationship / targeting marketing
IP address xTargeted marketing
  1. Rights of the data subject

The data subject has the following rights, requests to exercise which must be made to the address:

  • Right of access

The data subject may check the personal data we have stored.

  • Right to rectification

The data subject may request correction of incorrect or incomplete data concerning them.

  • Right to object

The data subject may object to the processing of personal data if they believe that personal data has been processed unlawfully.

  • Right to opt out of direct marketing

The data subject has the right to prohibit the use of data for direct marketing.

  • Right to erasure

The data subject has the right to request deletion of data if the processing of the data is not necessary. We will process the deletion request, after which we will either delete the data or provide a justified reason why the data cannot be deleted.

It should be noted that the controller may have a statutory or other right not to delete the requested information. The controller has an obligation to retain accounting material in accordance with the period defined in the Accounting Act (Chapter 2, Section 10) (10 years). For this reason, accounting-related material cannot be deleted before the deadline expires.

  • Withdrawal of consent

If the processing of personal data concerning the data subject is based solely on consent, and not, for example, on a customer relationship or membership, the data subject may withdraw consent.

  • The data subject may complain about the decision to the Data Protection Ombudsman

The data subject has the right to require that we restrict the processing of disputed data until the matter is resolved.

  • Right to lodge a complaint

The data subject has the right to make a complaint to the Data Protection Ombudsman if they feel that we violate the applicable data protection legislation when processing personal data.

Contact details of the Data Protection Ombudsman: www.tietosuoja.fi/fi/index/yhteystiedot.html

  1. Regular sources of information

Information on potential customers is obtained with their consent from the person themselves during a website visit or in connection with other personal or digital interactions.

  1. Regular disclosures of data

As a rule, data is not disclosed for marketing purposes outside Tunturipuun Kauppa Oy.

Data may be selectively disclosed to a third party commissioned by the controller for a targeted marketing campaign. Ownership of the data does not transfer from the controller to the third party and the third party does not have the right to use the data beyond the assignment.

We have ensured that all our service providers comply with data protection legislation. We regularly use the following service providers:

Here are examples:

  • Hubspot
  • Google
  • Dealfront(Leadfeeder)
  1. Duration of processing

Personal data is generally processed for as long as the customer relationship is in effect. A person registered on our customer list may unsubscribe themselves via the link in each marketing email we send.

  1. Processors of personal data

The controller and its employees process personal data. We may also outsource the processing of personal data partly to a third party, in which case we ensure through contractual arrangements that personal data is processed in accordance with applicable data protection legislation and otherwise appropriately.

  1. Transfer of data outside the EU

Personal data is not transferred outside the EU or the European Economic Area.

  1. Automated decision-making and profiling

We do not use data for automated decision-making or profiling.

Or for example:

We use personal data for both automated decision-making and profiling.

Automated decision-making means that a decision is made entirely automatically without human consideration. Profiling means processing personal data to assess certain characteristics related to a person, such as interests or behavior.

We use profiling, for example, [to target marketing communications / to score customer relationships / to personalize services]. Automated decision-making is used for example [to make loan decisions / to grant service access rights / to suggest offers].

The purpose of profiling and automated decision-making is [to improve the customer experience, to offer targeted content, to speed up decision-making].

The effect of automated decision-making may be, for example, that [a customer is offered different content, marketing or benefits than another customer] / [service access is granted or denied].

The legal basis for processing is [legitimate interest / performance of a contract / consent – choose depending on the situation].

The data subject has the right to:

not be subject solely to automated decision-making if it has legal effects or otherwise significantly affects them;

  • require that the decision is also reviewed by a human;
  • present their view on the decision and its grounds;

object to profiling and request the deletion of their data from the profiling register